Overview
An attacker used stolen credentials belonging to 4,837 GitHub accounts to target repositories with a malicious CI/CD secret stealer, according to Aikido Security. The campaign was observed across at least 1,806 repositories, while separate research identified malicious commits in more than 8,000 public repositories. The attack began with seemingly harmless pull requests titled “docs: dependency audit notes”, allowing the attacker to identify repositories where compromised accounts had write access before deploying the credential-stealing payload.
How the Attack Worked
The attacker used short-lived branches and apparently legitimate-looking commits to inject malicious code into GitHub Actions workflows or package installation processes. The stealer targeted secrets available to CI runners, including GitHub Actions tokens, cloud credentials, AWS/Azure/GCP credentials, SSH keys, package-manager credentials and AI service keys. In many cases the malicious changes were quickly reverted and execution logs removed, making the activity harder to detect while potentially leaving stolen credentials valid.
Why It Matters
The biggest risk is that compromising a GitHub account can provide access far beyond the repository itself. CI/CD workflows frequently have permissions to deploy applications, access cloud environments, publish packages and assume cloud identities. The malware was also capable of using stolen GitHub OIDC credentials to obtain AWS, Azure and GCP sessions, and researchers found techniques designed to maintain access even after credentials were rotated. This turns a compromised developer account into a potential gateway into the organisation’s wider cloud environment.
What Administrators Should Check
Security teams should immediately review repositories for suspicious wfx-docs branches, unusual CI workflow changes, docs: dependency audit notes pull requests and short-lived chore/ or ci-check- branches. Organisations should revoke affected GitHub tokens, OAuth grants, SSH keys and active sessions, enable 2FA and rotate every secret accessible to affected workflows. Cloud environments should also be checked for unexpected AWS AssumeRole or CreateAccessKey activity, Azure federated credentials using the wfx-ci-* naming pattern and unusual GCP workload-identity activity.
CI/CD Security Best Practices
CI/CD environments should operate with least privilege, using short-lived credentials and tightly scoped GitHub Actions permissions rather than long-lived secrets wherever possible. Cloud OIDC trust policies should restrict which repositories, branches and workflows can assume privileged roles, while self-hosted runners require additional monitoring because they can expose credentials from the underlying operating system and cloud metadata services. Organisations should also monitor changes to workflow files because a malicious workflow can be more dangerous than a compromised application dependency.
Supply Chain Risk
The campaign also demonstrates how attacks can move beyond source repositories into software distribution. Researchers identified malicious changes affecting package ecosystems including npm, Go, Packagist, PyPI and crates, although the attackers appeared primarily interested in stealing CI credentials rather than mass package distribution. This reinforces the need to secure the entire software-development lifecycle, including source control, CI runners, package publishing accounts, build infrastructure and cloud deployment identities.
Expert in the Cloud Insight
Your GitHub repository is increasingly part of your cloud security perimeter. A compromised developer account may not immediately provide access to production, but if CI/CD workflows are trusted to deploy infrastructure or assume cloud roles, that account can become the starting point for a much larger compromise. Organisations should therefore treat GitHub identities, CI/CD workflows and cloud IAM relationships as one connected security chain. Protecting the repository alone is not enough — the critical question is what an attacker can reach when that repository’s automation is compromised.
Expert in the Cloud – The Future Is Now.
Leave a Reply